How to Obtain an OJK Crypto Licence in Indonesia Physical Crypto Asset Traders (PAKD/PFAK) Explained

Indonesia’s crypto market has entered a decisive new regulatory era. The supervision of digital financial assets including crypto assets has formally transferred from the Commodity Futures Trading Supervisory Authority (Bappebti) to the Financial Services Authority (OJK), and OJK’s comprehensive licensing rulebook is now live. If you operate or plan to operate a crypto exchange or physical crypto asset trader in Indonesia, this guide explains the complete crypto licensing Indonesia framework: licence tiers, capital requirements, local-entity rules, the sandbox route, application steps, and practical timelines.

TL;DR action: Determine your route transfer a legacy Bappebti approval, register via SPRINT, enter the ITSK sandbox, or apply for a full OJK licence and begin your readiness assessment now. The licensing window is open and OJK is actively processing applications.

• Who this applies to: Founders, exchange operators, foreign entrants, compliance teams, and legal counsel advising on Indonesian crypto market access.
• Licence tiers covered: Pedagang Aset Keuangan Digital (PAKD), Bursa (exchange), Kustodian (custodian), and Lembaga Kliring (clearing institution).
• Key regulations: POJK 27/2024, POJK 23/2025 (amendment), PP 49/2024, and UU No. 4/2023 (P2SK).

Introduction Why Crypto Licensing Indonesia Matters Now

The statutory foundation for this regulatory shift is Undang-Undang Nomor 4 Tahun 2023 tentang Pengembangan dan Penguatan Sektor Keuangan (UU P2SK), which mandated the transfer of regulation and supervision of digital financial assets from Bappebti to OJK. This law, particularly Pasal 312 and related provisions, created the legal basis for OJK to assume full authority over crypto asset trading activities.

To operationalise the transfer, the Government issued Peraturan Pemerintah (PP) No. 49 Tahun 2024, which set out the transitional mechanics timing, data handover, and continuity provisions for existing Bappebti-approved operators. The formal transfer was confirmed completed in January 2025, with Bappebti handing over supervisory data, existing approvals, and ongoing enforcement matters.

OJK moved quickly to issue its primary rulebook: POJK No. 27 Tahun 2024 on the Organisation of Digital Financial Asset Trading Including Crypto Assets. This regulation governs licence types, capital thresholds, prudential requirements, consumer protection obligations, and application procedures. It was subsequently amended by POJK No. 23 Tahun 2025, which expanded the scope of permissible activities notably around derivative-like products and refined several procedural and prudential provisions.

The practical effect is immediate: operators still relying on legacy Bappebti terms must register with OJK via the SPRINT system, new entrants have a clear application pathway, and OJK’s ITSK sandbox provides an accelerated testing-to-licence route. Industry observers expect that operators who delay risk enforcement action or loss of market access as OJK consolidates its supervisory posture.

Quick Decision Tree: Which OJK Crypto Licence Applies to Your Business?

Before beginning the application process, you must classify your intended business activity against the licence categories established by POJK 27/2024. The following decision tree provides a starting point:

• Pedagang Aset Keuangan Digital (PAKD) / Physical Crypto Asset Trader: You buy, sell, or facilitate spot trading of crypto assets on behalf of customers the most common licence for retail-facing platforms and OTC desks.
• Bursa (Exchange): You operate a marketplace that matches buy and sell orders between multiple PAKD members or directly between participants.
• Kustodian (Custodian): You provide safekeeping, segregation, and administration of customer crypto assets and associated private keys.
• Lembaga Kliring (Clearing Institution): You perform clearing, settlement, and guarantee functions for crypto asset transactions executed on a Bursa.
• ITSK Sandbox Participant: You are a fintech innovator testing a crypto-related product or service within OJK’s regulatory sandbox, with the intention of converting to a full licence or registration upon successful completion.

Operators who already held Bappebti approvals are required to register their status with OJK via the SPRINT system (pendataan). The OJK FAQ on POJK 27/2024 provides specific guidance on the mapping of legacy Bappebti approvals to OJK licence categories and the timeline for completing that transition.

10-Step Roadmap: How to Obtain or Convert an OJK Crypto Licence

The following numbered process distils the regulatory requirements into a practical roadmap. Each step includes estimated lead times, though actual timelines depend on the completeness of your application, entity readiness, and OJK’s review capacity.

Step 1 Preliminary Classification and Gap Analysis

• Action: Determine whether your business model falls under PAKD, Bursa, Kustodian, or Lembaga Kliring as defined by POJK 27/2024. Conduct a gap analysis of your current corporate structure, capital position, technology stack, and compliance framework against the relevant requirements.
• Key consideration: If you hold a legacy Bappebti approval, confirm whether your existing scope maps directly to a single OJK licence tier or requires adjustment.
• Estimated lead time: 1–3 weeks.

Step 2 Entity and Ownership Model Design

• Action: Foreign entrants must establish a local Indonesian legal entity (Perseroan Terbatas / PT). Decide between a PT PMA (foreign-owned limited liability company), a joint venture with a local partner, or a fully domestic PT. All entities require at least one locally resident director and must meet OJK’s governance standards.
• Considerations: Nominee arrangements carry significant legal risk under Indonesian law and are strongly discouraged. PP 49/2024 and POJK 27/2024 require the applicant entity to be a bona fide Indonesian legal person. Industry observers note that OJK scrutinises beneficial ownership structures closely during the fit-and-proper review.
• Estimated lead time: 3–8 weeks (entity incorporation), longer if structuring a JV.

Step 3 Capital Planning and Prudential Fit

• Action: Model your minimum paid-up capital (modal disetor) against the thresholds set out in POJK 27/2024 for your licence tier. In addition to paid-up capital, prepare to demonstrate compliance with minimum equity / net adjusted working capital (MKBD) buffers, liquidity ratios, and segregated customer-account arrangements as required by the regulation.
• Key requirement: The capital must be fully paid and evidenced by audited financial statements and bank confirmation. POJK 23/2025 may have amended certain thresholds confirm against both POJK texts before finalising your capital structure.
• Estimated lead time: 2–6 weeks (capital injection and documentation).

Step 4 Technical and Security Readiness

• Action: Prepare your technology infrastructure evidence package. This typically includes ISO 27001 certification or equivalent, wallet architecture documentation (cold/hot storage split ratios), custody security measures, penetration test reports, SOC 2 attestation or equivalent third-party audit, disaster recovery and business continuity plans, and insurance certificates for custodial holdings.
• Practical note: OJK expects robust evidence of ongoing security practices, not just point-in-time attestations. Build continuous monitoring and periodic retesting into your operational plan.
• Estimated lead time: 4–12 weeks (dependent on existing infrastructure maturity).

Step 5 Compliance Suite: KYC, AML, and Transaction Monitoring

• Action: Develop and document a comprehensive AML/CFT programme aligned with POJK requirements and Indonesia’s financial crime regulations. This includes customer due diligence (KYC) procedures, enhanced due diligence for high-risk customers, sanctions screening, transaction monitoring systems, suspicious transaction reporting (STR) processes, and record-keeping protocols.
• Integration: Your AML programme must interface with OJK’s reporting requirements and Indonesia’s financial intelligence unit (PPATK). Ensure your compliance team includes qualified AML officers with relevant certifications.
• Estimated lead time: 3–8 weeks (policy development and system integration).

Step 6 Product and Asset Approvals

• Action: Prepare a token due diligence pack for each crypto asset you intend to list or trade. Each pack should include the asset’s whitepaper, technical architecture, governance structure, market data, risk assessment, and compliance with the approved asset list maintained by the Bursa or as stipulated by OJK.
• Important: Do not assume any token is approved verify against the official OJK or Bursa asset list. POJK 23/2025 expanded the scope of permissible products to include certain derivative-like instruments, but these require specific OJK approval.
• Estimated lead time: 2–6 weeks per asset category.

Step 7 Sandbox (ITSK) Route: When and How to Use It

• Action: If your product or service involves a novel technology or business model, consider applying to OJK’s ITSK regulatory sandbox. The sandbox allows you to test your product in a controlled environment under OJK supervision. Successful completion (a “Pass” result) can significantly accelerate the path to full registration or licensing.
• Eligibility: The sandbox is typically suited for innovations that do not fit neatly into existing regulatory categories, or where the applicant wishes to demonstrate viability before committing to full licensing capital requirements.
• Conversion path: Upon successful sandbox completion, the applicant may proceed to registration or full licence application with an expedited review. The sandbox pass serves as evidence of regulatory readiness.
• Estimated lead time: 6–12 months (sandbox testing period), plus 4–8 weeks for conversion to registration.

Step 8 Submit Application via SPRINT and Pay Fees via SIPO

• Action: File your complete application through OJK’s SPRINT electronic submission system. Ensure all required documents are uploaded, forms correctly completed, and fees paid through the SIPO payment platform. Key documents include the corporate charter, business plan, proof of capital, audited financials, director CVs and fit-and-proper declarations, IT architecture diagrams, AML/KYC policy documents, consumer protection SOPs, and insurance certificates.
• Confidentiality: Application materials submitted through SPRINT are treated as confidential by OJK. Public notice requirements may apply at certain stages consult the POJK procedural provisions.
• Estimated lead time: 2–4 weeks (compilation and submission).

Step 9 OJK Review, Fit-and-Proper Checks, and Engagement

• Action: OJK will conduct a completeness check, followed by a substantive review. Expect fit-and-proper interviews with directors and key personnel, requests for additional documentation, possible site visits to your operational and technology facilities, and queries on capital adequacy and segregation arrangements.
• Common queries: OJK frequently asks for clarification on beneficial ownership structures, the adequacy of cold-storage arrangements, the independence of compliance functions, and evidence of ongoing cybersecurity testing.
• Estimated lead time: 8–20 weeks (substantive review), with an additional 4–12 weeks for remedial requests and conditional approvals.

Step 10 Licence Grant and Post-Licence Obligations

• Action: Upon approval, OJK will issue the licence. Post-licence, you must comply with ongoing obligations including periodic financial reporting, annual audits, AML/CFT reporting to PPATK, regular capital adequacy monitoring, product approval for new tokens, consumer complaint handling, and participation in OJK’s supervisory activities.
• Ongoing compliance: Failure to maintain post-licence obligations can result in sanctions, licence suspension, or revocation. Ongoing compliance and reporting should be treated as a continuous programme, not a one-time exercise.
• Estimated lead time: 2–4 weeks (licence issuance after final approval).

Comparison Table: OJK Crypto Licence Tiers at a Glance

Note: Capital figures shown above are indicative ranges based on public regulatory materials. Applicants must confirm exact minimum paid-up capital and net adjusted working capital (MKBD) thresholds by consulting the specific articles of POJK 27/2024 and any amendments introduced by POJK 23/2025. Where the POJK text is ambiguous on a specific threshold, professional regulatory advisory is recommended.

The table illustrates a critical point: capital requirements scale significantly with the scope and systemic importance of the activity. A PAKD the most common licence tier for retail-facing crypto platforms carries a substantial but more accessible capital requirement than a full Bursa licence. The ITSK sandbox route offers a practical pathway for innovators to demonstrate product viability before committing full licensing capital, though conversion to a permanent licence ultimately requires meeting the same prudential standards.

For foreign entrants evaluating the Indonesian market alongside regional alternatives, this tiered structure offers flexibility but the mandatory local-entity requirement and the level of capital commitment mean that crypto licensing Indonesia demands careful structuring from the outset.

Key Requirements and Eligibility: Licence Tiers, Prudential Rules, and Local-Entity Obligations

Licence Tiers and Permitted Activities

POJK 27/2024 establishes clear boundaries for each licence tier. A PAKD may buy, sell, and facilitate spot crypto asset transactions for customers but may not operate a multi-party exchange (which requires a Bursa licence) or provide standalone custody services (which requires a Kustodian licence). The amendment introduced by POJK 23/2025 expanded the permissible scope for certain licensees to include derivative-like products, subject to specific OJK approval and additional prudential conditions.

Prohibited activities across all tiers include offering unregistered crypto assets, providing unsanctioned lending or staking products without OJK authorisation, and commingling customer assets with proprietary funds. OJK guidance emphasises that product innovations including staking, lending, and yield-generating arrangements require case-by-case approval and may be tested through the ITSK sandbox before commercial launch.

Minimum Capital and Prudential Requirements

The capital framework under POJK 27/2024 comprises two main elements: minimum paid-up capital (modal disetor) and ongoing minimum equity or net adjusted working capital (MKBD). Applicants must satisfy the paid-up capital threshold at the time of application and maintain MKBD above the prescribed floor throughout the licence term. POJK 23/2025 may have adjusted certain thresholds applicants should consult both regulatory texts and confirm the applicable figures for their tier by reference to the specific Pasal and ayat provisions.

In addition to capital, licensees must maintain segregated customer accounts, hold adequate liquidity buffers, and submit periodic capital adequacy reports to OJK. The segregation requirement is particularly important: customer crypto assets and fiat funds must be held in accounts entirely separate from the operator’s proprietary holdings, with independent custodial arrangements where required.

Local-Entity and Foreign Ownership Rules

All applicants must be incorporated as an Indonesian legal person (Perseroan Terbatas / PT). Foreign investors may participate through a PT PMA structure, subject to Indonesia’s foreign investment rules and any sector-specific ownership restrictions. PP 49/2024 established transitional provisions for entities that held Bappebti approvals under previous regulatory structures, allowing them to continue operating while completing OJK registration.

Key governance requirements include the appointment of at least one locally resident director, a board of commissioners with appropriate qualifications, and a compliance function staffed by personnel with demonstrable AML/CFT expertise. OJK conducts fit-and-proper assessments of all directors and key personnel, including background checks and integrity interviews.

Application Checklist, Document List, Timelines, and Costs

Document Checklist

The following documents and evidence are typically required for a complete SPRINT application:

• Corporate documents: Deed of incorporation, articles of association, shareholder registry, and beneficial ownership disclosure.
• Business plan: Detailed operational plan, financial projections (3–5 years), target market analysis, and product roadmap.
• Proof of capital: Bank statements, audited financial statements, and confirmation of paid-up capital from a licensed Indonesian bank.
• Director and key personnel CVs: Including fit-and-proper declarations, criminal record checks, and professional certifications.
• IT architecture diagrams: System topology, wallet architecture (cold/hot split), data flow diagrams, and disaster recovery plans.
• Security attestations: ISO 27001 certificate, SOC 2 report, penetration test results (from an accredited provider), and vulnerability assessment reports.
• AML/KYC policies: Complete programme documentation, including CDD/EDD procedures, transaction monitoring rules, STR processes, and sanctions screening workflows.
• Internal audit plan: Annual audit schedule, scope, and methodology.
• Consumer protection SOPs: Complaint handling, dispute resolution, data privacy, and customer fund segregation procedures.
• Token due diligence packs: For each crypto asset to be listed or traded whitepaper, technical assessment, risk analysis, and legal opinion.
• Insurance certificates: Professional indemnity and/or custodial insurance covering crypto asset holdings.
• Local registrations: Tax identification (NPWP), employment registrations (BPJS), and any other local regulatory filings.

Expected Timelines

• Pre-filing readiness: 2–12 weeks (entity setup, capital injection, documentation preparation).
• SPRINT submission to OJK completeness check: 2–6 weeks.
• Substantive review and fit-and-proper assessment: 8–20 weeks.
• Conditional approvals and remediation: 4–12 weeks.
• Final licence grant: 2–4 weeks after all conditions are met.

Caveat: Timelines may compress significantly for applicants who have successfully completed the ITSK sandbox programme. OJK’s published data on sandbox throughput and application processing suggests that well-prepared applicants with sandbox passes experience faster review cycles.

Indicative Costs

Applicants should budget for OJK administrative fees (per the applicable fee schedule), legal and advisory fees for application preparation, capital injection costs (minimum paid-up capital for the relevant tier), technical validation expenses (penetration testing, ISO certification, SOC 2 audits), and ongoing compliance costs (annual audits, reporting systems, AML programme maintenance). Cost ranges vary significantly based on the licence tier, entity structure, and the applicant’s existing infrastructure. Applicants are advised to obtain tailored cost estimates from qualified local counsel and technical service providers.

Common Pitfalls and How to Avoid Them

• Incomplete token due diligence packs: One of the most frequent causes of application delays. Ensure each asset has a comprehensive, legally reviewed DD pack before submission.
• Underestimating capital and liquidity buffers: Applicants often plan only for the minimum paid-up capital and overlook MKBD requirements and segregated customer account funding. Model the full prudential stack from the outset.
• Insufficient asset segregation: OJK places great emphasis on the separation of customer funds and crypto assets from proprietary holdings. Weak segregation arrangements are a red flag in review.
• Weak AML programme documentation: Generic or template-based AML policies are routinely flagged. The programme must be tailored to the specific risks of crypto asset trading and demonstrate operational integration with monitoring systems.
• Nominee ownership structures: Using nominee arrangements to circumvent local-entity or ownership requirements is a serious compliance risk that can result in application rejection and potential enforcement action.
• Under-prepared technical evidence: Submitting without a current SOC 2 report or recent penetration test results signals inadequate security readiness. Invest in accredited third-party attestations well ahead of filing.

Conclusion: Securing Your Crypto Licensing Indonesia Pathway

Indonesia’s crypto licensing landscape has undergone a fundamental transformation. With OJK now exercising full supervisory authority and a comprehensive regulatory framework in place through POJK 27/2024 and POJK 23/2025, the pathway to lawful crypto asset trading operations is clear but demands rigorous preparation. The transition from Bappebti to OJK is not merely administrative; it represents a step-change in prudential standards, consumer protection expectations, and ongoing compliance obligations.

For founders, exchange operators, and foreign entrants evaluating crypto licensing Indonesia, the priority actions are straightforward: conduct a regulatory classification and gap analysis against the POJK requirements, structure your local entity and capital position, build your compliance and technology evidence base, and engage with OJK whether through the ITSK sandbox for innovative models or a direct SPRINT application for established business lines. The operators who move decisively through this licensing window will secure regulated market access in one of Southeast Asia’s largest and fastest-growing digital asset markets.

Sources

• Undang-Undang Nomor 4 Tahun 2023 tentang Pengembangan dan Penguatan Sektor Keuangan (UU P2SK)
• Peraturan Pemerintah (PP) No. 49 Tahun 2024 Peralihan tugas pengaturan dan pengawasan ke OJK/BI
• OJK POJK No. 27 Tahun 2024: Penyelenggaraan Perdagangan Aset Keuangan Digital termasuk Aset Kripto
• OJK POJK No. 23 Tahun 2025 (Amendment to POJK 27/2024) Press Release
• OJK / Bappebti Joint Press Release Transfer of Regulation and Supervision Duties
• OJK ITSK Regulatory Sandbox